cve.bz

faveosuite faveo-helpdesk vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 5.3CVE-2026-125387EPSS 0.2%

    Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, ch…

  2. 5.3CVE-2026-124025EPSS 0.3%

    Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticke…

  3. 5.3CVE-2026-111676EPSS 0.3%

    Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket…